Microsoft MN700 hack project

[3chansen]

I have been looking for a custom firmware for this router...but haven't found anything on the net! Microsofts firmware for this thing SUCKS! But I think it could be an awesome router with the right firmware. (great signal and range). I knew it was a broadcom, so I took a few snaps of the innards to see if it was another router branded with the "microsoft" name.



sure enough, the Microsoft name is on the PCB...but all the chips look very standard...like they could run Linux!

Here is the radio (wireless card):



PLEASE let me know if you find ANY compatible firmware for this thing...even if it is a stock netgear/buffalo/etc. Stock Linksys wouldn't be bad. Most of all, I want to enable wireless bridge/AP Client mode. Please email me if you find out anything
email me
Thanks
Chuck

[Antiloop]

to me it looks very familair to the WL500g, if you are willing to risk you can try to flash a custom WL500g or WLHDD firmware into it

but you should not do this when you are not familair recovering the unit from dead

[Oleg]

Linksys firmware will not run, cause it uses different design for ethernet ports. Asus, Belkin, Buffalo firmwares are potentially able to run. Openwrt also.
Are you familar with hardware? Your device has JTAG port, so you could save current flash content (to analyze bootloader - one option is really make sense) and then flash whatever you want. This is risk free.

[3chansen]

I don't know what kind of pinout the jtag has...could you point me to a site that gives the pinout? I assume I just have to solder a DB-9 cable to the jtag header with the right pinout. If you could help me with that and saving the firmware, I could email it to you for analysis (since I don't know what I'm looking for in the firmware) Soldering is no biggie for me. (don't tell M$ since its Windows CE
Chuck

[3chansen]

http://openwince.sourceforge.net/jtag/iPAQ-3600/

Scrolling down through the article, the hack got this simple cable to work on his ipaq. Of course, my JTAG is 12pin, not 10pin. I assume the pinout is the same??? And can someone point the flash chip out on this thing? (maybe under the wireless card)....the software on the site says it supports intel or amd flash chips...maybe it would work.

It has 16MB RAM, and im guessing 4MB flash (M$ can't fit CE on less than that im guessing)

Chips seem to be the same, minus the layout.

So I wonder if there is any opperational difference between this and an Asus WL500g...

Also, the BCM4702 natively supports USB...so I can add a usb port to this router? Maybe someone can figure out the connections to do such a thing

[Oleg]

http://openwince.sourceforge.net/jtag/iPAQ-3600/

Scrolling down through the article, the hack got this simple cable to work on his ipaq. Of course, my JTAG is 12pin, not 10pin. I assume the pinout is the same??? And can someone point the flash chip out on this thing? (maybe under the wireless card)....the software on the site says it supports intel or amd flash chips...maybe it would work.

Check this:
http://www.openwrt.org/forum/viewtopic.php?t=647

It has 16MB RAM, and im guessing 4MB flash (M$ can't fit CE on less than that im guessing)

Chips seem to be the same, minus the layout.

So I wonder if there is any opperational difference between this and an Asus WL500g...

The difference are in GPIO mappings (this includes LEDs, reset buttons, etc...).

[Intelman]

Me and a few others have been pushing for a hack on this router. The microsoft firmware doesn't seem to cut it. We asked sveasoft, right here http://www.dslreports.com/forum/rema...6800~mode=flat

Also if someone can program in .NET, maybe they can provide modules?

"The Wireless Base Station MN-700 is powered by Windows® CE .NET 4.2,enabling Microsoft, its partners and other developers to create additional applications and benefits for customers"


Hopefully someone figures out a Hack!

[pcbroch]

I have my MN700 (running the WL firmware) all configured and running fine. Now I configured it as an AP and I can't login to the web interface anymore? What have I done? How can I fix it? Reflash?

Thanks!

Edit:

Actually, I got it back... Somehow, it reverted to "DHCP" for it's IP address, I have no idea why. I reverted to static and voila... feel free to delete this post.

[pcbroch]

I'm having a problem getting my DYNDNS Custom DNS host to update it's IP using Oleg's WL500g-1.9.2.7-6b.trx

In the logs, I get:
Jul 10 22:07:00 ddns update: connected to members.dyndns.org (63.208.196.94) on port 80.
Jul 10 22:07:00 ddns update: invalid hostname: myhostnamegoeshere.com

Is this supposed to work? I can get it to update no problem with $vea$oft's Talisman on a Linksys router.

EDIT:
I telneted to the box and used ez-ipupdate (which is what I assume is used for the DDNS updates), and can update my ip without problems:

Jul 10 23:31:06 ddns update: connected to members.dyndns.org (63.208.196.94) on port 80.
Jul 10 23:31:07 ddns update: request successful

Does anyone know what calls ez-ipupdate in the firmware? There must be a bug in there somewhere.

[ACluk90]

Hi
I would set it up in the webinterface(IP-config/miscellaneous).
Look at the attachment to see my config.

ACluk90

[pcbroch]

Hi
I would set it up in the webinterface(IP-config/miscellaneous).
Look at the attachment to see my config.

ACluk90

First, you are using DynDNS and I'm using DynDNS CUSTOM.

I know how to and WOULD set it up from the web interface if it worked. But the reason I'm trying to do it manually is that it is not working from the web interface. I'm trying to figure out how the web interface translates into actual commands, so I can find what broken and get it fixed.

FYI, there another person with the same problem:
http://wl500g.info/showthread.php?t=2461

[Oleg]

I'm having a problem getting my DYNDNS Custom DNS host to update it's IP using Oleg's WL500g-1.9.2.7-6b.trx

In the logs, I get:
Jul 10 22:07:00 ddns update: connected to members.dyndns.org (63.208.196.94) on port 80.
Jul 10 22:07:00 ddns update: invalid hostname: myhostnamegoeshere.com

Is this supposed to work? I can get it to update no problem with $vea$oft's Talisman on a Linksys router.

EDIT:
I telneted to the box and used ez-ipupdate (which is what I assume is used for the DDNS updates), and can update my ip without problems:

Jul 10 23:31:06 ddns update: connected to members.dyndns.org (63.208.196.94) on port 80.
Jul 10 23:31:07 ddns update: request successful

Does anyone know what calls ez-ipupdate in the firmware? There must be a bug in there somewhere.

How ez-update should be called for custom dns? I will then check rc sources...

[pcbroch]

How ez-update should be called for custom dns? I will then check rc sources...

I suspect it's a problem with the service-type. But I can update manually by typing:

ez-ipupdate -S dyndns-custom -u user:password -h mydomain.com -i the_pppoe_interface

[pcbroch]

Any luck with this Oleg? (Or simply not the time to look at it?).

This is the only thing missing for my perfect setup!

Worst case PM me the source, I'll have a look.

[Oleg]

Sorry, I had no time to check this yet.